Re: [PATCH] audit: speedup for syscalls when auditing is disabled
On Tue, 2010-08-24 at 11:14 -0400, Miloslav Trmac wrote:
----- "Eric Paris" <eparis(a)redhat.com> wrote:
> Add a new spot in the assembly which will call a function which will
> check if audit_n_rules > 0 and if so will set TIF_SYSCALL_AUDIT and if
> not will clear TIF_SYSCALL_AUDIT? It might make things slightly worse
> on systems which explictly disable audit and the flag would always be
> clear on every task (like you did with the explicit rule) but I'm
> guessing might be a win on systems with no rules which are wasting time
> on the audit slow path.....
Is "audit_n_rules" a specific enough trigger? Right now, even if
there are no rules configured at all, audit_log_start() while
processing a syscall will mark that syscall for auditing, and all
collected information about the syscall will be logged at syscall
exit.
Would the suggested change break this behavior?
That's correct, if there are 0 rules we still collect information while
knowing that it will get thrown away at the end (since obviously no rule
is going to switch the state from 'build' to 'on')
The only real loss is that a syscall in progress when a rule is loaded
would get audited today and wouldn't get audited with my new proposal.
I don't see that as an unacceptable race.....
-Eric